Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Normally, I would:

  • Change the SSH to protocol 2, disallow root login, change the port and only allow public keys.
  • Install fail2ban.
  • Install Bastille-Linux and run through it (setting up firewall etc.)
  • Run chkrootkit and rkhunter on cron.

What else can I do to help secure a Debain server (VPS)?

share|improve this question

migrated from superuser.com Oct 4 '10 at 18:41

This question came from our site for computer enthusiasts and power users.

4 Answers 4

up vote 0 down vote accepted

There are tools to keep up to date with both operating system and application patches and configuration tests. Some of them include best practices. You can run them on a regular basis to get a picture of your security posture. You can even write your own rules, after much study, to ensure that systems maintain your planned configuration.

The US Department of Homeland Security is the front for a very large effort to develop open standards for security products. They and their contractor Mitre have developed a language called OVAL that is the Open Vulnerability and Assessment Language. It uses a combination of "platforms" like Windows, Linux, and Cisco IOS that various scanning engines have to support. These scanning engines then take "definitions" of specific tests to execute against the host or target and produce a report.

If all of this sounds very generic, it is. On purpose. This allows Debian to issue their own "definitions" on their website once. They don't care what tool does the scanning or reporting. No GUIs required. A free scanner and results writer, the OVAL Interpreter, can be downloaded from sourceforge.net. Instructions are also available.

Now that you have tools to verify that your applications are as secure as possible, you can continue providing protection at the network layer against specific attacks.

share|improve this answer

Run through the Securing Debian Howto.

Install all patches and keep patched. I install unattended-upgrades and enable security related updates.

I usually install Shorewall as a firewall with an appropriate example configuration as a starting point. Then I limit access to the Internet to expected traffic.

share|improve this answer
    
Thanks for your help. I will look into using "unattended-upgrades". –  jSherz Oct 9 '10 at 15:22

Those are all good suggestions, and it looks like you're on the right path already. However, don't neglect the applications/services running on the box. Unless you have a user with a default or very easily guessable password, most cracks are not going to come via SSH. They're going to come via a web application, or mail server, or some other service that is running and publicly available on the box.

Securing the base OS is only step 1. Securing the applications is even more critical for long term security.

share|improve this answer
    
The only applications that are accessible remotely are SSH and the HTTP server - therefore I will take especial care to monitor those. Thanks for pointing this out. –  jSherz Oct 9 '10 at 15:22

Run nessus or any other vulnerability scanner to make sure your harden your server well enough.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.